CVE-2026-102831

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.5.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Notebook versions 7.5.0 through 7.6.2 JupyterLite Core versions 0.7.0 through 0.8.3

Description The system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing the metadata.trusted attribute. When the useSystemClipboardForCells setting is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted. This allows the bypass of output sanitization and the execution of scripts within the authenticated JupyterLab origin without requiring the cell to be executed. Markdown and raw cells are not affected as their output is sanitized.

Recommendations Update JupyterLab to version 4.5.11 or 4.6.4. Update Notebook to version 7.6.3. Update JupyterLite Core to version 0.8.4.